Overview

overview

10

Static

static

6

ee2370e2a1...18.apk

android-9-x86

10

ee2370e2a1...18.apk

android-10-x64

10

ee2370e2a1...18.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee2370e2a1a7f85a99ece79d33a51b6b_JaffaCakes118

  • Size

    133KB

  • Sample

    240411-xtx7saad23

  • MD5

    ee2370e2a1a7f85a99ece79d33a51b6b

  • SHA1

    cfd04ada3f64ae25667fe63dac1a7908070559ec

  • SHA256

    075352f0f8ac06163f06380fba36d778046e5c9ce3ffa15ef082f2ea1fec09eb

  • SHA512

    f0a73e930f289f65f811dc71fe2e0d8478f2a59f0666878dc6a85053d49e2271aeff874add80f1b348e4ac4043ed608bb66bd7966ba962cdc91bdee6f28d6453

  • SSDEEP

    3072:Cdk1gubPqNARcwz7qCeCM0cuLuIQ2XzXcvIQ:PREARo0covQ2jsvIQ

Score
10/10
cerberusandroidbankercollectiondiscoveryevasioninfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

https://bensiznekadarmutluolabilirsinki.club

Targets

    • Target

      ee2370e2a1a7f85a99ece79d33a51b6b_JaffaCakes118

    • Size

      133KB

    • MD5

      ee2370e2a1a7f85a99ece79d33a51b6b

    • SHA1

      cfd04ada3f64ae25667fe63dac1a7908070559ec

    • SHA256

      075352f0f8ac06163f06380fba36d778046e5c9ce3ffa15ef082f2ea1fec09eb

    • SHA512

      f0a73e930f289f65f811dc71fe2e0d8478f2a59f0666878dc6a85053d49e2271aeff874add80f1b348e4ac4043ed608bb66bd7966ba962cdc91bdee6f28d6453

    • SSDEEP

      3072:Cdk1gubPqNARcwz7qCeCM0cuLuIQ2XzXcvIQ:PREARo0covQ2jsvIQ

    Score
    10/10
    cerberusbankercollectiondiscoveryevasioninfostealerratstealthtrojan

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

      bankertrojaninfostealerevasionratcerberus

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasion

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

      evasiondiscovery

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

      evasiondiscovery

    • Queries the phone number (MSISDN for GSM devices)

      discovery

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Listens for changes in the sensor environment (might be used to detect emulation)

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks